Skip to content

feat(mcp): re-export UnauthorizedError so hosts can detect auth failures - #7

Merged
siarheidudko merged 1 commit into
mainfrom
claude/mcp-remote-http-oauth-ges1mj
Aug 16, 2026
Merged

feat(mcp): re-export UnauthorizedError so hosts can detect auth failures#7
siarheidudko merged 1 commit into
mainfrom
claude/mcp-remote-http-oauth-ges1mj

Conversation

@siarheidudko

Copy link
Copy Markdown
Member

Why

A host that wants to react to a mid-session authorization failure — the one case where the transport gives up and a human has to re-authorize — had no way to recognise it.

The SDK's UnauthorizedError extends Error but never assigns this.name:

export class UnauthorizedError extends Error {
    constructor(message) { super(message ?? 'Unauthorized') }
}

so err.name is "Error". A host checking err.name === 'UnauthorizedError' silently never matches, and matching on the message would also catch a tool whose own error text happens to say "unauthorized" (our connector throws the server's text verbatim for isError results). Without the class itself, there is no reliable handle.

Found by review of the React bindings (dudko-dev/agent-web-react#3), where that check was dead code: the panel kept reporting "connected" while every tool call failed.

What

./mcp re-exports UnauthorizedError from the SDK, so an identity check runs against the same module instance the connector uses. One line of surface; no behaviour change.

The accompanying test pins the assumption this export exists for — if the SDK ever starts setting name, the test says so rather than leaving a silently redundant export behind.

typecheck, format:check, build, test (90 passing) are green. Version bumped to 0.0.12 so the release workflow publishes it.


Generated by Claude Code

A host that wants to react to a mid-session authorization failure — the
one case where the transport gives up and needs a human — had no way to
recognise it. The SDK's UnauthorizedError never assigns `this.name`, so
it reads as "Error"; matching on the name silently never fires, and
matching on the message would also catch a tool whose own error text
happens to mention "unauthorized".

Exporting the class from the subpath gives an identity check that works
against the same module instance the connector uses. Found by review of
the React bindings, where exactly this check was dead code.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011FKop4At26QqqkwVGEjJur
@siarheidudko
siarheidudko merged commit 6b57059 into main Aug 16, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants